General

  • Target
    Order List.exe
  • Size 307KB
  • Sample220322-ddbjasece6
  • SHA256 f35b19f498e527a1a8eca51ec82221c55c2f969efb59b2c0b6cff0f3e0e852f6
  • MD5 SHA1 SHA512
Score
10/10

Malware Config

Extracted

Family
  • xloader

Version
  • 2.5

Campaign
  • mwfc

Decoy
  • a-great-intl-voip-phones.zone

  • police-trust-security.com

  • 415391.com

  • coi-sl.com

  • liming-steel.com

  • criticalracetheoryexplained.com

  • pintoent.com

  • columbusrx.com

  • clarktribe.net

  • texasforblanchard.com

  • musical.voyage

  • priyamblogs.com

  • employbridge.works

  • americanchessmaster.com

  • australiaaddictioncenters.com

  • drkell-yann.xyz

  • barryisdaner.com

  • frankkystein.art

  • aromatoto7.com

  • alsuwal.com

Targets

    • Target
      Order List.exe
    • Size 307KB
    • SHA256 f35b19f498e527a1a8eca51ec82221c55c2f969efb59b2c0b6cff0f3e0e852f6
    • MD5 SHA1 SHA512
    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks